This of course assumes that it wasn’t really you from an IP that was just misidentified as being from Brazil.
For what it’s worth, I stopped using LastPass after they sold out to LogMeIn and would recommend others stop using it as well.
I hadn't logged into that LastPass account for years, so it's definitely not me who attempted to login earlier.
Re: LastPass, is there another cloud-based tool that's generally considered as more trustworthy? Bitwarden? Thanks
Sure, managing the KeePass files by hand is certainly more cumbersome, but to me it’s worth it for the security/ peace of mind gains. I have never put my DB or key files in the cloud. And when I need to sync them up over all my devices, I gather all the DB files and use the handy ‘merge’ functionality to get them into the same state.
It sounds a bit complicated reading this back, but in reality it's pretty straightforward.
FWIW, I used to run nextcloud on a ec2 instance. Decided to just use dropbox instead. the webdav support on nextcloud was neat with keepass
Not saying Dropbox or lastpass isn’t trustworthy. Just that it’s a point of failure you can eliminate, if the lack of convenience isn’t a huge deal to you.
So yeah, take Lastpass off the list, I don’t trust them :)
The problem is... that LastPass password, the one stored in KeePass, is presumably the one that was leaked.
Which is what is spooking me -- if someone has access to my entire KeePass file, it's game over.
The LastPass account that was almost-breached today uses the "password sharing" functionality to share passwords (to certain sites) with other people in the same org.
I was just explaining that the only reason why I have a LastPass account was to share passwords. (not the master password, obviously -- I was sharing passwords to other sites)
I typically use KeePass for all of my (site) passwords and keepass stores all of this in a local encrypted file.
https://1password.community/discussion/comment/602340/#:~:te...
Left a really bad taste in my mouth. I wouldn't be using them at all if I didn't have to for a client.
Someone received a phishing email from "their bank."
They responded to the email, and got someone on the horn, immediately.
But their bank (the real one), sent them to a horrifying voice jail.
The point was that the crooks gave better customer service than the real bank.
I got an email one day that my new Barclaycard was activated. Called support, and they swore to me it was a phishing email (it was definitely from Barclay's official domain). Would not listen to me at all and kept trying to get me to hang up. I asked if I could tell them the email MessageID and they could verify the authenticity. They said no.
About 10 minutes into trying to convince them it was not a phishing email, I refresh my dashboard and there was a $600 purchase at a Long Island Walmart. That shut them up really quickly and they transferred me to their fraud department who asked me for the MessageID at the bottom of the activation email and confirmed it was real...
I asked if I could set up any additional security, and how could they activate a new credit card? Did they have my online password? Apparently no, you can just call on the phone and activate it, no authentication required. They told me I could set up a "voice password" for my account for all phone support and I did just that.
I called them back 30 minutes later, got through to support to where I could change anything about my account. Asked them if my "Voice Password" was enabled. "Yes it is." "....Okay, no one has asked me for my voice password yet, and here you are about to change my address". They still didn't really understand the seriousness, so I told them "I'm not <my name> I'm a hacker trying to steal his money." and they understood.
The worst part? I couldn't cancel that credit card until they physically sent me one to activate. No way to visit a branch and get one. It ended up getting stolen out of the mail THREE TIMES before they finally sent it with a signature required.
1. BW supports inline Android 11 password fill. I find the UX much better with this feature
2. LP is a bit buggy, particularly on Android
3. LP is slow to add new features
4. I didn't expect this, but I really enjoyed BW's UI
5. On Android, I enjoy the three quick launch buttons they provide
6. LP creates new logins in folders of it's choosing by default. Not a fan
But in general, BW it just "works" better/faster for me